RISC V Enclaves A Clean Slate Approach To Linux Security
summary
Claims a concrete, working RISC-V enclave stack that partitions an SoC into isolated zones using multi-zone PMP enforcement, not virtualization. It runs on a 4+1 core configuration with an MCU for deterministic zones, enforces separation with a 2 KB nano-kernel, and requires ~8–16 PMP registers (software extension gives unlimited regions). Demonstrated on PolarFire SoC with Linux hosting device-driver zones, signed flash images and a tiny messaging IPC; the demos run on real hardware and require one plain policy file, no recompiles.
AI-written summary · about
chapters (8)
- 0:00Intro
- 0:26Securing Mixed Criticality Systems
- 5:45Linux Uncomfortable Truth
- 7:15RISC-V Security Primitives
- 11:25MultiZone Security For Linux
- 16:43MultiZone Security - How It Works
- 17:24MultiZoneTM Security PolarFire Edition - Live Demo
- 18:25MultiZone Security PolarFire Edition - Live Demo
related talks
18mIntroducing RISC-V Confidential Computing for IoT Devices
09mThe Future of Embedded Security with RISC-V
13mRISC-V: Securing the Future of Open Source Computing
28mSanctum: Minimal Hardware Extensions for Strong Software Isolation
52mEnabling New Security Frontiers: Deep-Dive Into Implementing Confidential Computing on RISC-V
15mCore slicing: closing the gap between leaky confidential VMs and bare-metal cloud
16mTrusted RV: Trusted Execution Environment, Secure Coprocessor, and their Program...
16mKeynote: NVIDIA’s secure RISC-V processor